MalwareHunterTeam tweeted about a piece of spyware for Android that had a very low detection rate on VirusTotal. Researchers at ESET discovered that it was part of the malware toolkit used by the APT-C-23 threat actor. The spyware is from a group of advanced hackers running espionage campaigns against military and educational institutions since before July 2015. ESET published a technical report detailing the new capabilities of the improved spyware. It can now read notifications from messaging apps (WhatsApp, Facebook, Telegram, Instagram, Skype, Messenger, Viber)
Source: https://www.bleepingcomputer.com/news/security/fake-threema-telegram-apps-hide-spyware-for-targeted-attacks/